For security or licensing reasons, a particular software application may be bound to a specific device during installation or registration or first initialization process. Once the software application is bound to a particular device or user, the piece of software (e.g., the software application) may only be executed on that particular device. Once bound, the piece of software cannot be executed on another device if the piece of software is copied to another device
Further, in multi-step security verification, in addition to setting up a user name and password for a Web based service, a user is required to setup security questions. When the Web based service is used for the first time via an Internet browser of a different type, the user is required to enter the answers to the security questions in order to bind the Internet browser to the Web based service. These bindings are typically stored as cookie(s) in the Internet browser. When a different browser is used or when browser cookies are deleted, the user needs to bind the Web based service to the Internet browser again. This method is prone to security breaches if user authentication information and security questions/answers are stolen.
Methods such as the use of RFID tags or device serial number, etc., may be employed to obtain a unique identification of the hardware. However, in some scenarios, such as when a software code executes in a Web browser, the software code may not have access to underlying hardware resources to obtain the identification information. Moreover, as explained by Sanjay E. Sarma, Stephen A Weis, Daniel W. Englels in “RFID Systems and Security and Privacy Implications”, CHES 2002, LNCS 2523, 2003, there are privacy concerns as to use of RFID or hardware serial numbers as this information may uniquely identify a person.